@platformos/platformos-mcp-supervisor 0.1.0 → 0.2.0

package/dist/impact/diff.js

@@ -0,0 +1,33 @@
+/** The comparison key: what makes two findings the same finding. */
+function identityOf(diagnostic) {
+    return `${diagnostic.check}\u0000${diagnostic.line}\u0000${diagnostic.column}`;
+}
+/**
+ * The diagnostics in `after` that are not in `before`, preserving `after`'s order.
+ *
+ * `before` is the file as it stands with NONE of the changeset overlaid; `after` is the same
+ * file with the changeset applied. Everything returned is therefore attributable to the
+ * change.
+ */
+export function introducedDiagnostics(after, before) {
+    if (after.length === 0)
+        return [];
+    const remaining = new Map();
+    for (const diagnostic of before) {
+        const key = identityOf(diagnostic);
+        remaining.set(key, (remaining.get(key) ?? 0) + 1);
+    }
+    const introduced = [];
+    for (const diagnostic of after) {
+        const key = identityOf(diagnostic);
+        const unmatched = remaining.get(key) ?? 0;
+        // Each `before` occurrence cancels exactly one `after` occurrence, so a code that
+        // legitimately fires twice does not swallow a third.
+        if (unmatched > 0)
+            remaining.set(key, unmatched - 1);
+        else
+            introduced.push(diagnostic);
+    }
+    return introduced;
+}
+//# sourceMappingURL=diff.js.map

package/dist/impact/impact.d.ts

@@ -1,9 +1,21 @@
-import { type AdapterInput } from '../adapter-input.js';
+import { type DocsetVocabulary } from '../enrich/enrich.js';
+import type { BatchBuffer, runBatchLint } from '../lint/lint-batch.js';
 import type { ValidateCodeImpact } from '../result/types.js';
 import type { ProjectScan } from './project-scan.js';
+/** Everything one impact pass needs. The lint seam is injected so the contract is testable. */
+export interface ImpactInput {
+    projectDir: string;
+    /** The changeset, exactly as the primary lint received it. */
+    buffers: readonly BatchBuffer[];
+    scan: ProjectScan;
+    lint: typeof runBatchLint;
+    docset: () => Promise<DocsetVocabulary>;
+    log: (message: string) => void;
+}
 /**
- * Compute the edited file's blast radius from the project as it is right now.
- * Reports `not_applicable` when nothing could reference the file by name, and
- * throws only on real I/O failure — the caller degrades that to `unavailable`.
+ * The impact of the whole changeset, per requested buffer key.
+ *
+ * Throws only on real I/O failure — the caller degrades that to `unavailable` for every
+ * buffer, because a failure here says nothing about any of them.
  */
-export declare function runImpact(params: AdapterInput, scan: ProjectScan): Promise<ValidateCodeImpact>;
+export declare function runImpact(input: ImpactInput): Promise<Map<string, ValidateCodeImpact>>;

package/dist/impact/impact.js

@@ -1,189 +1,160 @@
 /**
- * Impact (blast-radius) adapter — an I/O boundary on the request path (sibling
- * to `lint/`).
+ * Impact — what this change breaks in files the agent is NOT editing.
  *
- * Answers the one question lint structurally cannot: "who DEPENDS ON the file
- * being edited?" — its incoming references across the project.
+ * Lint is per-file and forward-looking: it visits only the buffers it was sent, so a page
+ * that the edited partial has just broken is never even looked at. This stage looks at it,
+ * and it does so by ASKING THE CHECK ENGINE rather than by re-deriving the answer:
  *
- * HOW, AND WHY IT IS NOT A GRAPH. Every edge platformos-graph records names its target with
- * a STATIC STRING LITERAL: the operand of `render`/`include`/`function`/`background`/
- * `graphql`, the operand of `asset_url`, or an explicit frontmatter `layout:` (an omitted
- * `layout:` synthesizes no edge — see `traverse.ts`). So a file's dependents can only be
- * among the edge sources whose TEXT contains its logical name, and filtering on that name is
- * a sound over-approximation leaving few survivors (measured p50 1, p90 6 candidates on a
- * 2,615-file project). Those are parsed and resolved with {@link extractFileReferences}, the
- * SAME resolver `buildAppGraph` runs, so this answer cannot drift from the graph's — 80
- * targets sampled across two real projects produced 0 mismatches on `(source, kind, args)`.
+ *   pass A   the dependants, linted with the changeset overlaid
+ *   pass B   the same dependants, linted with nothing overlaid
+ *   report   A \ B — exactly the findings this change introduced
  *
- * THERE IS NO `computing` STATE. The answer is derived from the project as it is at request
- * time, so it is fresh by construction. A failure or the deadline yields `unavailable`; a
- * file the graph cannot model yields `not_applicable`; everything else is `computed`.
+ * WHY A DIFF AND NOT A CHECK-CODE ALLOWLIST. An earlier version compared `{% doc %}`
+ * parameters by hand, which reimplemented `MissingRenderPartialArguments` with no message,
+ * no documentation link and an invented severity. The diff needs no list of "cross-file
+ * relevant" codes, because relevance is CAUSAL: a `DeprecatedFrontmatterField` already in a
+ * dependant is irrelevant for having been there BEFORE, not for its code. A check added
+ * upstream is covered on the day it ships, with no edit here.
  *
- * The dependents list reads the CHANGESET, not just disk: `ProjectScan` overlays the buffers
- * under validation, so a caller a buffer has just added or removed is counted.
+ * SERIALIZED, BY NECESSITY. `lintBuffers` overlays buffers into check-node's process-shared
+ * `App` and reverts them on the way out, and that App has no lock. Two lint passes therefore
+ * cannot overlap — with each other, or with the request's primary lint. The orchestrator
+ * runs the primary lint concurrently with the project SCAN (pure fs reads, no App) and only
+ * then runs these two passes, so the write gate is never delayed by, or lost to, impact.
+ *
+ * BOUNDED BY INPUT, NOT BY THE DEADLINE. `IMPACT_DEADLINE_MS` cannot bound this: a lint is
+ * synchronous CPU work and no timer preempts it. `MAX_CANDIDATE_BYTES` caps the text
+ * discovery will parse and `MAX_DEPENDANTS_LINTED` caps how many dependants are linted, both
+ * derived in `cost-model.ts` to fit inside that deadline. Hitting either is REPORTED —
+ * `status: unavailable` or `unchecked_dependants` — never silently absorbed.
+ *
+ * NOTHING HERE IS A CLEARANCE. A dependant that names its target at runtime, or that does
+ * not parse, is invisible to discovery — so an empty answer means no break was FOUND among
+ * the dependants that are visible, never that none exists.
  */
-import { extractDocDefinition, path, SourceCodeType, } from '@platformos/platformos-check-common';
-import { sourceCodeTypeOf, uriToName } from '@platformos/platformos-common';
-import { extractFileReferences, toSourceCode, } from '@platformos/platformos-graph';
+import { path } from '@platformos/platformos-check-common';
+import { uriToName } from '@platformos/platformos-common';
 import { toAbsoluteFilePath } from '../adapter-input.js';
-/** Number of referencing files listed in `sample`/`signature_risk` before truncating. */
-const SAMPLE_LIMIT = 10;
+import { MAX_DEPENDANTS_LINTED } from '../cost-model.js';
+import { enrichBatch } from '../enrich/enrich.js';
+import { NOT_APPLICABLE_IMPACT, UNAVAILABLE_IMPACT } from '../result/impact-states.js';
+import { canHaveDependants, dependantsOf, toDependantBuffers } from './dependants.js';
+import { introducedDiagnostics } from './diff.js';
 /**
- * The edge kinds whose call-site arguments are validated against a partial's
- * `{% doc %}` `@param` contract — EXACTLY the kinds the `PartialCallArguments`
- * lint check validates (`render`/`include` via its `RenderMarkup` handler,
- * `function` via `FunctionMarkup`). `background`/`graphql`/`layout`/`asset` edges
- * carry scheduling/operation arguments that are NOT `@param`s, so signature-impact
- * must ignore them or it would flag correct calls (a false positive that the
- * forward `PartialCallArguments` check never produces).
- */
-const SIGNATURE_EDGE_KINDS = new Set(['render', 'include', 'function']);
-/**
- * Whether the graph can model incoming references to `uri` — i.e. `uri` can be a
- * resolvable edge TARGET (a Liquid page/layout/partial, or a GraphQL operation).
- * Reuses check-common's canonical classifiers so this cannot drift from the
- * graph's own edge resolution.
+ * The impact of the whole changeset, per requested buffer key.
  *
- * Files that are NOT edge targets — schema / custom-model-type / translation YAML,
- * or any unclassified file — are wired by model/table NAME, not by file reference
- * (ADR 004), so the graph has no dependents for them and `total: 0` would be a
- * false "safe to change". Those get `status: 'not_applicable'` instead.
+ * Throws only on real I/O failure — the caller degrades that to `unavailable` for every
+ * buffer, because a failure here says nothing about any of them.
  */
-function isGraphTrackable(uri) {
-    // The graph's edge-target types, asked by extension. Naming the two explicitly keeps the
-    // YAML case visibly excluded, which is the distinction the docblock above turns on.
-    const type = sourceCodeTypeOf(uri);
-    return type === SourceCodeType.LiquidHtml || type === SourceCodeType.GraphQL;
-}
-/** A fresh zeroed dependents shape for every non-`computed` status. */
-const noDependents = () => ({
-    total: 0,
-    by_kind: {},
-    sample: [],
-});
-/**
- * Compute the edited file's blast radius from the project as it is right now.
- * Reports `not_applicable` when nothing could reference the file by name, and
- * throws only on real I/O failure — the caller degrades that to `unavailable`.
- */
-export async function runImpact(params, scan) {
-    const { projectDir, filePath, content } = params;
+export async function runImpact(input) {
+    const { projectDir, buffers, scan } = input;
     const rootUri = path.normalize(path.URI.file(projectDir));
-    const fileUri = path.normalize(path.URI.file(toAbsoluteFilePath(projectDir, filePath)));
-    // Applicability is a property of the FILE, independent of any scan: a non-trackable file
-    // has no dependency edges, and a file in no platformOS directory has no logical NAME for
-    // a reference to spell. `total: 0` for either would be a false "safe to change".
-    const name = uriToName(fileUri, rootUri)?.name;
-    if (!isGraphTrackable(fileUri) || name === undefined) {
-        return { scope: 'direct', status: 'not_applicable', dependents: noDependents() };
+    const uriOf = (buffer) => path.normalize(path.URI.file(toAbsoluteFilePath(projectDir, buffer.filePath)));
+    // A file in the changeset is reported on its own terms. Excluding the whole changeset from
+    // every dependant set is also what makes the scan's text the DISK text for each dependant,
+    // which is exactly what pass B's baseline needs.
+    const changeset = new Set(buffers.map(uriOf));
+    const byBuffer = new Map();
+    const dependantsPerBuffer = new Map();
+    for (const buffer of buffers) {
+        const uri = uriOf(buffer);
+        // Applicability is a property of the FILE and needs no scan. The name is read separately
+        // because discovery needs the STRING while `canHaveDependants` answers a boolean; the
+        // second condition below narrows that string and is not a second rule.
+        const name = uriToName(uri, rootUri)?.name;
+        if (!canHaveDependants(uri, rootUri) || name === undefined) {
+            byBuffer.set(buffer.filePath, NOT_APPLICABLE_IMPACT());
+            continue;
+        }
+        const dependants = await dependantsOf(scan, uri, name, changeset);
+        // `null` is "too much candidate text to examine", NOT "no dependants". Reported as
+        // `unavailable`, which is what it is: the comparison did not run.
+        if (dependants === null) {
+            byBuffer.set(buffer.filePath, UNAVAILABLE_IMPACT());
+            continue;
+        }
+        dependantsPerBuffer.set(buffer.filePath, dependants);
+        byBuffer.set(buffer.filePath, { status: 'computed' });
     }
-    const dependents = await incomingReferences(scan, fileUri, name);
-    const signature = await docSignature(fileUri, content);
-    const signature_risk = signature && computeSignatureRisk(dependents, rootUri, signature);
-    return {
-        scope: 'direct',
-        status: 'computed',
-        dependents: summarizeDependents(dependents, rootUri),
-        ...(signature_risk ? { signature_risk } : {}),
-    };
+    const found = [...new Set([...dependantsPerBuffer.values()].flat())].sort((a, b) => a.localeCompare(b));
+    if (found.length === 0)
+        return byBuffer;
+    // BOUNDED INPUT, not a deadline: a lint is synchronous CPU work and no timer preempts it
+    // (see `deadline.ts`), so the only defence is refusing to start more of it than fits.
+    // Sorted first, so which dependants survive the bound is deterministic rather than
+    // whichever order a directory walk happened to produce.
+    const linted = new Set(found.slice(0, MAX_DEPENDANTS_LINTED));
+    const introduced = await introducedByDependant(input, [...linted]);
+    for (const [key, dependants] of dependantsPerBuffer) {
+        const checked = dependants.filter((uri) => linted.has(uri));
+        const breaks = checked
+            .map((uri) => ({ uri, diagnostics: introduced.get(uri) ?? [] }))
+            .filter(({ diagnostics }) => diagnostics.length > 0)
+            .map(({ uri, diagnostics }) => ({ file: path.relative(uri, rootUri), diagnostics }));
+        const impact = { status: 'computed' };
+        // Omitted when empty. An empty list reads as "checked, nothing depends on this that
+        // could break", which a scan of the dependants that happen to be VISIBLE cannot earn.
+        if (breaks.length > 0)
+            impact.breaks = breaks;
+        // Reported per buffer rather than per request: the bound is global, but whether it cost
+        // THIS buffer anything depends on how many of its own dependants fell past it.
+        if (checked.length < dependants.length) {
+            impact.unchecked_dependants = { returned: checked.length, total: dependants.length };
+        }
+        byBuffer.set(key, impact);
+    }
+    return byBuffer;
 }
 /**
- * Every reference in the project that resolves to `fileUri`.
+ * The findings each dependant gained because of the changeset, keyed by its URI.
  *
- * The name filter is what keeps this cheap, and it is sound rather than heuristic: an edge
- * exists only where a static literal spells the target's logical name. Everything past the
- * filter is exact — the survivors are resolved by the graph's own resolver, so a candidate
- * that merely MENTIONS the name contributes no reference.
+ * The two passes are AWAITED IN SEQUENCE, never raced: they share check-node's process-wide
+ * `App`, and an overlay installed by one while the other is reverting would corrupt both.
  */
-async function incomingReferences(scan, fileUri, name) {
+async function introducedByDependant(input, dependants) {
+    const { projectDir, buffers, scan, lint, docset, log } = input;
     const sources = await scan.sources();
-    const candidates = [...sources].filter(([, source]) => source.includes(name));
-    const perCandidate = await Promise.all(candidates.map(async ([uri, source]) => {
-        const sourceCode = await toSourceCode(uri, source);
-        return extractFileReferences(scan.rootUri, uri, sourceCode, { fs: scan.fs });
-    }));
-    return perCandidate.flat().filter((reference) => reference.target.uri === fileUri);
-}
-/**
- * Reduce the incoming reference edges of the edited file to the agent-facing
- * summary: distinct referencing FILES (`total`), distinct files per edge kind
- * (`by_kind`), and a capped, sorted `sample` of project-relative caller paths.
- */
-function summarizeDependents(references, rootUri) {
-    // caller path (project-relative) → the edge kinds by which it references the file
-    const callers = new Map();
-    for (const ref of references) {
-        if (!ref.kind)
-            continue; // every graph edge carries a kind; defensive only
-        const caller = path.relative(ref.source.uri, rootUri);
-        const kinds = callers.get(caller) ?? new Set();
-        kinds.add(ref.kind);
-        callers.set(caller, kinds);
-    }
-    const by_kind = {};
-    for (const kinds of callers.values()) {
-        for (const kind of kinds)
-            by_kind[kind] = (by_kind[kind] ?? 0) + 1;
+    const dependantBuffers = toDependantBuffers(dependants, sources);
+    const keyOf = new Map(dependantBuffers.map((buffer) => [buffer.filePath, buffer.uri]));
+    // WITH the changeset overlaid. The changeset's own buffers are included because a
+    // dependant must see the edit to be broken by it; their results are discarded here, since
+    // the primary lint already reported them.
+    const after = await lint({ projectDir, buffers: [...buffers, ...dependantBuffers] });
+    // Only a dependant that found something in pass A needs a baseline: the diff is A \ B, so
+    // an empty A is empty whatever B holds. Worth less than it looks — measured, a page
+    // reports `DeprecatedFrontmatterField` whatever it contains, so only partial dependants
+    // are ever clean enough to skip.
+    const withFindings = dependantBuffers.filter((buffer) => (after.diagnostics.get(buffer.filePath)?.length ?? 0) > 0);
+    const before = withFindings.length
+        ? await lint({ projectDir, buffers: withFindings })
+        : undefined;
+    const enriched = await enrichBatch(onlyDependants(after, keyOf), docset, log);
+    const introduced = new Map();
+    for (const [filePath, uri] of keyOf) {
+        const gained = introducedDiagnostics(enriched.get(filePath) ?? [], before?.diagnostics.get(filePath) ?? []);
+        if (gained.length > 0)
+            introduced.set(uri, gained);
     }
-    const sample = [...callers.keys()].sort((a, b) => a.localeCompare(b)).slice(0, SAMPLE_LIMIT);
-    return { total: callers.size, by_kind, sample };
+    return introduced;
 }
 /**
- * The edited buffer's `{% doc %}` parameter contract (required + all declared
- * names), or `null` when the buffer is non-Liquid, unparseable, or declares no
- * `{% doc %}` block. Reuses check-common's `extractDocDefinition` — the same
- * primitive the `PartialCallArguments` check reads for the doc case — so the
- * two never diverge. `null` deliberately disables signature-impact: without an
- * explicit contract we do NOT guess a signature (no false positives).
+ * Pass A narrowed to the dependants, so enrichment is not paid a second time for the
+ * changeset's own findings — the primary lint has already enriched those.
  */
-async function docSignature(fileUri, content) {
-    const sourceCode = await toSourceCode(fileUri, content);
-    if (sourceCode.type !== SourceCodeType.LiquidHtml || sourceCode.ast instanceof Error)
-        return null;
-    const definition = await extractDocDefinition(fileUri, sourceCode.ast);
-    const parameters = definition.liquidDoc?.parameters;
-    if (!parameters || parameters.length === 0)
-        return null;
-    return {
-        required: parameters.filter((p) => p.required).map((p) => p.name),
-        allowed: parameters.map((p) => p.name),
-    };
-}
-/**
- * The dependent callers whose passed arguments violate `signature` — missing a
- * required `@param`, or passing one the `{% doc %}` block does not declare. The
- * cross-file inverse of `PartialCallArguments`: it checks the edited file's
- * contract against every existing caller at once. Deduplicated per caller,
- * sorted, and capped.
- */
-function computeSignatureRisk(references, rootUri, signature) {
-    const byCaller = new Map();
-    for (const ref of references) {
-        // Only the kinds whose args ARE `@param`s (see {@link SIGNATURE_EDGE_KINDS}) —
-        // a `{% background %}`/`{% graphql %}`/layout edge's args are not, and flagging
-        // them would be a false positive the forward check never makes.
-        if (!ref.kind || !SIGNATURE_EDGE_KINDS.has(ref.kind))
-            continue;
-        const args = ref.args ?? [];
-        const missing = signature.required.filter((param) => !args.includes(param));
-        const unexpected = args.filter((arg) => !signature.allowed.includes(arg));
-        if (missing.length === 0 && unexpected.length === 0)
+function onlyDependants(pass, keyOf) {
+    const diagnostics = new Map();
+    const sources = new Map();
+    for (const key of keyOf.keys()) {
+        const found = pass.diagnostics.get(key);
+        // A dependant the lint DECLINED (excluded by config, say) has no diagnostics entry.
+        // Skipped rather than defaulted to `[]`, which would report it as checked and clean.
+        if (found === undefined)
             continue;
-        const caller = path.relative(ref.source.uri, rootUri);
-        const entry = byCaller.get(caller) ?? { missing: new Set(), unexpected: new Set() };
-        for (const m of missing)
-            entry.missing.add(m);
-        for (const u of unexpected)
-            entry.unexpected.add(u);
-        byCaller.set(caller, entry);
+        diagnostics.set(key, found);
+        const source = pass.sources?.get(key);
+        if (source)
+            sources.set(key, source);
     }
-    return [...byCaller.entries()]
-        .sort(([a], [b]) => a.localeCompare(b))
-        .slice(0, SAMPLE_LIMIT)
-        .map(([caller, { missing, unexpected }]) => ({
-        caller,
-        missing_required: [...missing].sort((a, b) => a.localeCompare(b)),
-        unexpected_args: [...unexpected].sort((a, b) => a.localeCompare(b)),
-    }));
+    return { diagnostics, sources, notChecked: pass.notChecked };
 }
 //# sourceMappingURL=impact.js.map

package/dist/impact/project-scan.d.ts

@@ -1,22 +1,24 @@
 /**
  * The project's edge-source files as TEXT, read ONCE per request.
  *
- * This is the whole of the blast radius's project state. The trade is deliberate: pay a
- * project READ per request — I/O, on the threadpool, overlapping the lint's CPU — instead
- * of a whole-project PARSE once and a lifetime of keeping it honest. Measured on a real
- * project (2,615 edge sources, 3.0 MB): 235 ms. Being derived per request, it cannot be stale,
- * which is why `impact` has no `computing` state.
+ * This is the whole of impact's project state, and it is read only when some buffer in the
+ * request could HAVE dependants — decidable from the paths alone, before any I/O. The trade
+ * is deliberate:
+ * pay a project READ per request — I/O, on the threadpool, overlapping the lint's CPU —
+ * instead of a whole-project PARSE once and a lifetime of keeping it honest. Measured on a
+ * real project (2,615 edge sources, 3.0 MB): 235 ms. Being derived per request, it cannot be
+ * stale, which is why `impact` has no `computing` state.
  *
  * SCOPE. Only EDGE SOURCES are read (`enumerateEdgeSources` — page/layout/partial), because
  * only their content can declare an edge; `.graphql`/`.yml`/asset files are leaves and can
  * never be the SOURCE of a reference. That is the graph's own definition, imported rather
  * than restated.
  *
- * BUFFERS WIN OVER DISK. The changeset under validation is overlaid, so a partial a buffer
- * has only just started rendering counts as a dependent, and one whose call a buffer has
- * just deleted stops counting — otherwise this stage would answer from disk while the lint
- * beside it answers from the buffer. A buffer for a file not yet on disk is ADDED when it is
- * an edge source, so a brand-new page's `{% render %}` is seen.
+ * BUFFERS WIN OVER DISK. The changeset under validation is overlaid, so a call a buffer has
+ * only just added counts, and one it has just deleted stops counting — otherwise this stage
+ * would answer from disk while the lint beside it answers from the buffer. A buffer for a
+ * file not yet on disk is ADDED when it is an edge source, so a brand-new page's
+ * `{% render %}` is seen.
  */
 import { type UriString } from '@platformos/platformos-check-common';
 import type { AbstractFileSystem } from '@platformos/platformos-common';

package/dist/impact/project-scan.js

@@ -1,22 +1,24 @@
 /**
  * The project's edge-source files as TEXT, read ONCE per request.
  *
- * This is the whole of the blast radius's project state. The trade is deliberate: pay a
- * project READ per request — I/O, on the threadpool, overlapping the lint's CPU — instead
- * of a whole-project PARSE once and a lifetime of keeping it honest. Measured on a real
- * project (2,615 edge sources, 3.0 MB): 235 ms. Being derived per request, it cannot be stale,
- * which is why `impact` has no `computing` state.
+ * This is the whole of impact's project state, and it is read only when some buffer in the
+ * request could HAVE dependants — decidable from the paths alone, before any I/O. The trade
+ * is deliberate:
+ * pay a project READ per request — I/O, on the threadpool, overlapping the lint's CPU —
+ * instead of a whole-project PARSE once and a lifetime of keeping it honest. Measured on a
+ * real project (2,615 edge sources, 3.0 MB): 235 ms. Being derived per request, it cannot be
+ * stale, which is why `impact` has no `computing` state.
  *
  * SCOPE. Only EDGE SOURCES are read (`enumerateEdgeSources` — page/layout/partial), because
  * only their content can declare an edge; `.graphql`/`.yml`/asset files are leaves and can
  * never be the SOURCE of a reference. That is the graph's own definition, imported rather
  * than restated.
  *
- * BUFFERS WIN OVER DISK. The changeset under validation is overlaid, so a partial a buffer
- * has only just started rendering counts as a dependent, and one whose call a buffer has
- * just deleted stops counting — otherwise this stage would answer from disk while the lint
- * beside it answers from the buffer. A buffer for a file not yet on disk is ADDED when it is
- * an edge source, so a brand-new page's `{% render %}` is seen.
+ * BUFFERS WIN OVER DISK. The changeset under validation is overlaid, so a call a buffer has
+ * only just added counts, and one it has just deleted stops counting — otherwise this stage
+ * would answer from disk while the lint beside it answers from the buffer. A buffer for a
+ * file not yet on disk is ADDED when it is an edge source, so a brand-new page's
+ * `{% render %}` is seen.
  */
 import { path } from '@platformos/platformos-check-common';
 import { enumerateEdgeSources, isEdgeSource } from '@platformos/platformos-graph';

package/dist/result/assemble.d.ts

@@ -10,7 +10,6 @@ export declare function assembleResult(diagnostics: ValidateCodeDiagnostic[], im
  * own validation failed would make the tool a liability. `reason` lands in `next_step`;
  * `code` lands in `not_applicable_reason` for an agent to branch on.
  *
- * `impact` is `not_applicable`, and its zeroed `dependents` must never be read as "nothing
- * depends on this".
+ * `impact` is `not_applicable`: nothing cross-file was compared either.
  */
 export declare function assembleNotApplicableResult(declined: Declined): ValidateCodeResult;

package/dist/result/assemble.js

@@ -55,8 +55,7 @@ export function assembleResult(diagnostics, impact) {
  * own validation failed would make the tool a liability. `reason` lands in `next_step`;
  * `code` lands in `not_applicable_reason` for an agent to branch on.
  *
- * `impact` is `not_applicable`, and its zeroed `dependents` must never be read as "nothing
- * depends on this".
+ * `impact` is `not_applicable`: nothing cross-file was compared either.
  */
 export function assembleNotApplicableResult(declined) {
     return {

package/dist/result/blocking.d.ts

@@ -65,10 +65,16 @@ export declare const BLOCKING_CHECKS: ReadonlySet<string>;
  * - `UniqueDocParamNames`, `ValidDocParamTypes` — doc hygiene with no runtime effect, since
  *   `{% doc %}` is inert at runtime.
  * - `ImgWidthAndHeight`, `ParserBlockingScript` — performance advice.
- * - `ValidFrontmatter` — two of its three findings (unknown key, missing layout) ARE hard
- *   deploy rejections, so this absence is a known gap rather than a judgement. All three
- *   share one code with no discriminator, so adding it would fix two false approvals and
- *   create one false block. Blocked on a discriminator — TASK-26.
+ * - `DeprecatedFrontmatterField` — measured: a deprecated key (`layout_name` naming a layout
+ *   that exists, `redirect_url`) and a deprecated `home.liquid` filename are all ACCEPTED by
+ *   the converter. Superseded, not broken.
+ *
+ * `ValidFrontmatter` used to be listed here, recorded as blocked on a discriminator
+ * (TASK-26) because "two of its three findings" were fatal and blocking the code would have
+ * created one false block. Both halves were wrong. It had seven reachable shapes, not three,
+ * and `layout: false` — the finding named as the harmless one — is itself a converter
+ * rejection. It has since been split into per-shape codes, which is the discriminator the
+ * task was waiting for: three of them are in the set above, two are named here.
  */
 /** A diagnostic, narrowed to what the gate reads. */
 interface GateInput {

package/dist/result/blocking.js

@@ -41,10 +41,15 @@ export const BLOCKING_CHECKS = new Set([
     // Does not parse. Nothing downstream can be trusted about the file at all.
     'LiquidHTMLSyntaxError',
     // Unparseable YAML. Measured: `pos-cli deploy --dry-run` REJECTS the file ("Body
-    // contains invalid YAML"), failing the WHOLE changeset. Scoped to SYNTAX on purpose —
-    // the converter accepts unknown property types and duplicate property names, so
-    // schema-shape validation would block nothing real.
+    // contains invalid YAML"), failing the WHOLE changeset. Scoped to SYNTAX, which is a
+    // narrower claim than it used to make here: a REAL deploy rejects an unknown property
+    // TYPE (now `InvalidSchemaPropertyType`) and an unknown top-level key, both of which
+    // `--dry-run` misses by returning before the nested converter. Duplicate property names
+    // ARE accepted — measured.
     'YAMLSyntaxError',
+    // `Attribute type `x` is not allowed`, from the nested `CustomAttributeConverter`.
+    // Measured by a REAL deploy; `--dry-run` accepts it.
+    'InvalidSchemaPropertyType',
     // Broken reference: the target does not exist, so the render fails at runtime.
     'MissingPartial',
     // platformOS raises on an unknown filter rather than ignoring it.
@@ -82,6 +87,21 @@ export const BLOCKING_CHECKS = new Set([
     // content, so one that cannot is a defeated contract — and a silently blank page
     // is harder to diagnose than an error.
     'MissingContentForLayout',
+    // --- Frontmatter, split out of `ValidFrontmatter`. Each is a measured converter
+    // rejection, which fails the WHOLE changeset. ---
+    // `Body contains invalid YAML: <parser error>`. `YAMLSyntaxError` cannot cover this —
+    // it is YAML-typed and never sees a `.liquid` file.
+    'InvalidFrontmatterSyntax',
+    // `Unknown properties: <key>.`
+    'UnknownFrontmatterField',
+    // `Request method 'POST' is not allowed`, and `layout: false` → `undefined method 'sub'
+    // for false` (YAML reads it as a boolean; `set_layout` guards `nil`, not `false`).
+    'InvalidFrontmatterValue',
+    // `Could not find Layout with layout: <name>`.
+    'MissingLayout',
+    // `<page> tries to assign authorization_policies which do not exist: <name>`. Measured by
+    // a REAL deploy — `--dry-run` accepts it, returning before the association write.
+    'MissingFrontmatterAssociation',
 ]);
 /**
  * Whether this set of diagnostics should stop the agent writing the file.

package/dist/result/impact-states.d.ts

@@ -1,16 +1,19 @@
 /**
- * The non-`computed` blast-radius states.
+ * The non-`computed` impact states.
  *
- * Each is a FACTORY, not a shared constant: the zeroed `dependents` object is mutable and
- * ends up inside a returned result, so one shared instance would let a mutation reach every
- * past and future response.
+ * Each is a FACTORY, not a shared constant: the object ends up inside a returned result, so
+ * one shared instance would let a mutation reach every past and future response.
  *
- * IMPORTANT: `dependents` is meaningful ONLY when `status` is `computed`. Every state here
- * zeroes it, and a zero must NEVER be read as "nothing depends on this, safe to change" —
- * that is what `status` is for.
+ * NEITHER IS A CLEARANCE, and neither is `computed` — impact publishes findings only, so
+ * nothing here or anywhere else says "nothing depends on this". See `ValidateCodeImpact`.
  */
 import type { ValidateCodeImpact } from './types.js';
-/** The blast radius could not be computed at all — a failure, or a deadline. */
+/** The cross-file comparison could not be run at all — a failure, or a deadline. */
 export declare const UNAVAILABLE_IMPACT: () => ValidateCodeImpact;
-/** This file has no dependency edges to speak of — see `ValidateCodeImpactStatus`. */
+/**
+ * The server was started with `--no-impact`, so nothing cross-file was attempted. Distinct
+ * from `unavailable` on purpose: a retry cannot change this one.
+ */
+export declare const DISABLED_IMPACT: () => ValidateCodeImpact;
+/** This file has no dependants the graph can find — see `ValidateCodeImpactStatus`. */
 export declare const NOT_APPLICABLE_IMPACT: () => ValidateCodeImpact;

package/dist/result/impact-states.js

@@ -1,18 +1,10 @@
-const noDependents = () => ({
-    total: 0,
-    by_kind: {},
-    sample: [],
-});
-/** The blast radius could not be computed at all — a failure, or a deadline. */
-export const UNAVAILABLE_IMPACT = () => ({
-    scope: 'direct',
-    status: 'unavailable',
-    dependents: noDependents(),
-});
-/** This file has no dependency edges to speak of — see `ValidateCodeImpactStatus`. */
-export const NOT_APPLICABLE_IMPACT = () => ({
-    scope: 'direct',
-    status: 'not_applicable',
-    dependents: noDependents(),
-});
+/** The cross-file comparison could not be run at all — a failure, or a deadline. */
+export const UNAVAILABLE_IMPACT = () => ({ status: 'unavailable' });
+/**
+ * The server was started with `--no-impact`, so nothing cross-file was attempted. Distinct
+ * from `unavailable` on purpose: a retry cannot change this one.
+ */
+export const DISABLED_IMPACT = () => ({ status: 'disabled' });
+/** This file has no dependants the graph can find — see `ValidateCodeImpactStatus`. */
+export const NOT_APPLICABLE_IMPACT = () => ({ status: 'not_applicable' });
 //# sourceMappingURL=impact-states.js.map